Connection forwarding

ABSTRACT

Two or more network traffic processors connected with the same LAN and WAN are identified as neighbors. Neighboring network traffic processors cooperate to overcome asymmetric routing, thereby ensuring that related sequences of network traffic are processed by the same network proxy. A network proxy can be included in a network traffic processor or as a standalone unit. A network traffic processor that intercepts a new connection initiation by a client assigns a network proxy to handle all messages associated with that connection. The network traffic processor conveys connection information to neighboring network traffic processors. The neighboring network traffic processors use the connection information to redirect network traffic associated with the connection to the assigned network proxy, thereby overcoming the effects of asymmetric routing. The assigned network proxy handles redirected network traffic in much the same way that it would handle network traffic received directly.

CROSS-REFERENCES TO RELATED APPLICATIONS

This application is a continuation application of U.S. patentapplication Ser. No. 12/331,257, filed Dec. 9, 2008 (now U.S. Pat. No.8,140,690, issued Mar. 20, 2012), which is a divisional application ofU.S. patent application Ser. No. 11/377,906, filed Mar. 15, 2006, whichclaims priority to U.S. Provisional Patent Application No. 60/663,366,filed on Mar. 18, 2005, each of which are incorporated by referenceherein for all purposes.

This application is related to U.S. patent application Ser. No.10/285,315, filed Oct. 30, 2002 (now U.S. Pat. No. 7,120,666, issuedOct. 10, 2006), entitled “Transaction Accelerator for Client-ServerCommunication Systems,” hereafter referred to as “McCanne I”; and U.S.patent application Ser. No. 10/640,562, filed Aug. 12, 2003 (now U.S.Pat. No. 7,318,100, issued Jan. 8, 2008), entitled “Cooperative ProxyAuto-Discovery and Connection Interception,” hereafter referred to as“McCanne IV,” each of which are incorporated by reference herein for allpurposes.

BACKGROUND OF THE INVENTION

The present invention relates to field of data networks and specificallyto systems and methods of improving network performance. Network proxiesand other types of network devices can be used to cache or store networkdata, accelerate network traffic, or otherwise control or affect networktraffic between clients and servers.

As used herein, “client” generally refers to a computer, computingdevice, peripheral, electronics, or the like, that makes a request fordata or an action, while “server” generally refers to a computer,computing device, peripheral, electronics, or the like, that operates inresponse to requests for data or action made by one or more clients. Acomputer or other device may be considered a client, a server, or bothdepending upon the context of its behavior.

As used herein, a request can be for operation of the computer,computing device, peripheral, electronics, or the like, and/or for anapplication being executed or controlled by the client. One example is acomputer running a word processing program that needs a document storedexternally to the computer and uses a network file system client to makea request over a network to a file server. Another example is a requestfor an action directed at a server that itself performs the action, suchas a print server, a processing server, a database server, a controlserver, and equipment interface server, an I/O (input/output) server,etc.

A request is often satisfied by a response message supplying the datarequested or performing the action requested, or a response messageindicating an inability to service the request, such as an error messageor an alert to a monitoring system of a failed or improper request. Aserver might also block a request, forward a request, transform arequest, or the like, and then respond to the request or not respond tothe request. Generally, a request-response cycle can be referred to as a“transaction” and for a given transaction, some object (physical,logical and/or virtual) can be said to be the “client” for thattransaction and some other object (physical, logical and/or virtual) canbe said to be the “server” for that transaction.

A client issues request messages to a server, which typically delivers aresponse message to each request message back to the client. Asdescribed in McCanne I and McCanne IV, a network proxy communicatingwith one or more peer network proxies can provide transactionacceleration, traffic reduction, and other functions over a wide areanetwork interposed between two local area networks (LANs). Typically, insuch a configuration, a client's request is intercepted by a client-sidenetwork proxy, which is connected with the client via a client LAN, anddelivered via the WAN to a server-side network proxy. The server-sidenetwork proxy delivers the client request message to the server via aserver LAN. The request message may be transformed or processed by thetwo proxies so that the request message (and possibly future requestmessages) are more effectively transported across the interveningnetwork than would be true without the use of the cooperating networkproxies. A message generally can be structured in any format or datastructure suitable for conveying information over a communicationsnetwork, including a single network packet or multiple network packets.

In these proxy-based systems, packets sent from the client are receivedat the client-side proxy; packets from the client-side proxy arereceived at the server-side proxy; and packets from the server-sideproxy are received at the server. In many networks, these arrangementsfrom client to server are sufficient to ensure the reverse direction ofcommunication from server to client as well, viz. that packets from theserver are received at the server-side proxy, packets from theserver-side proxy are received at the client-side proxy, and packetsfrom the client-side proxy are received at the client.

However, in some network environments this reverse direction ofcommunication is more problematic. In particular, a LAN including aclient or server can have multiple redundant connections with the WAN.As a result, asymmetric routing can produce situations in which aresponse packet from server to client may traverse a different path thanthe path used by a request packet from client to server. Where theproxies can rearrange the communication between client and serverwithout the knowledge or participation of the client or server, reversetraffic that bypasses the proxies and their hidden cooperativearrangements can cause performance degradation or a total failure of theproxied connection between client and server. This problem with networkproxies and asymmetric routing is mentioned in “Transparent ProxySignalling,” Knutsson, Bjorn and Peterson, Larry, Journal ofCommunications Networks, March 2001; however, no solution to thisproblem is proposed.

It is therefore desirable for a system and method to override theeffects described here. It is further desirable for the system andmethod to redirect related sequences of network traffic through theappropriate WAN or other network connection. It is additionallydesirable for the system and method to remain transparent to clients andservers while redirecting network traffic through the appropriate WAN orother network connection.

BRIEF SUMMARY OF THE INVENTION

In an embodiment of the invention, two or more network proxies connectedwith the same LAN and WAN are identified as neighbors, for example byincluding explicit configuration of network proxies or by an inferenceof a neighbor relationship from other information available. Networkproxies that are neighbors cooperate to overcome the effects ofasymmetric routing and other effects by forwarding packets to each otheras necessary, such as to ensure that related sequences of networktraffic are processed by the same network proxies.

In an embodiment, the proxy in a neighbor group that intercepts a newconnection initiation by a client, for example by receiving a SYNpacket, is considered the “owning proxy” of that connection. Uponreceiving a new connection initiation by a client, the owning proxyfirst conveys to all of its neighboring proxies identifying informationabout the new connection, then opens its inner connection across the WANto a counterpart network proxy to further communicate the new connectioninitiation of the client. In some cases, the information is not conveyedto all neighboring proxies, but to some of them. In such cases, it mighthelp to simply consider that the uninformed neighboring proxies are notin fact neighbors even though they might qualify to be neighbors.

In an embodiment, the other proxies in the neighbor group use theidentifying information they have received from the owning proxy tohandle packets that might otherwise bypass the owning proxy due toasymmetric routing or other network behaviors. A neighbor proxy thatreceives a packet matching the identifying information might alter theaddressing information of the packet so that it is received by theowning proxy. The owning proxy then can be expected to handle the packetin much the same way that it would handle a packet that it had receiveddirectly.

In an embodiment, a neighbor relationship can be explicitly ended by theowning proxy or the neighbor proxy. When a neighbor relationship isended, the neighbor proxies discard the identifying information. Inanother embodiment, a neighbor proxy can use the identifying informationto query the owning proxy for the status of the correspondingconnection. The neighbor proxy discards that information if the owningproxy indicates that the connection has closed, or if the owning proxydoes not recognize the connection, or if the owning proxy fails torespond.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention will be described with reference to the drawings, inwhich:

FIG. 1 illustrates an example network and potential problems caused byasymmetric routing.

FIGS. 2A and 2B illustrate examples of networks and improved networktraffic flow according to embodiments of the invention.

FIG. 3 illustrates an example of the information maintained by aneighboring network connection according to an embodiment of theinvention.

FIG. 4 illustrates a method of initiating a new connection according toan embodiment of the invention.

FIG. 5 illustrates a method of processing network traffic associatedwith a connection according to an embodiment of the invention.

FIG. 6 illustrates an additional network according to an embodiment ofthe invention.

In the drawings, the use of identical reference numbers indicatessimilar components.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 illustrates an example network 100 and potential problems causedby asymmetric routing. FIG. 1 shows communication between client 110 andserver 150 across a wide-area network (WAN) 130, where the communicationis mediated by two proxies, a client-side proxy 120 and a server-sideproxy 140. In this example network configuration, a message 115 sent byclient 110 and addressed to server 150 is intercepted by client-sideproxy 120. Client-side proxy 120 sends message 135 to server-side proxy140.

In some applications, message 135 is identical to message 115. In otherapplications, for example if client-side proxy 120 includes networkacceleration or caching functions, client-side proxy 120 transformsmessage 115 into an equivalent message 135 that may differ from message115 in many ways, including size, encoding, framing, addressing, orother aspects. The server-side proxy 140 receives message 135 andtransforms it into message 145, which is identical to, or an acceptablesubstitute for, original message 115. As network 100 is configured, thetwo proxies 120 and 140 are invisible in their effect: client 110 andserver 150 send and receive messages that are identical to, or anacceptable substitute for, what would occur if message 115 were simplysent directly to server 150 from client 110.

A similar process applies to messages sent in the reverse direction:message 155 is addressed to client 110 but is intercepted by server-sideproxy 140. Server-side proxy 140 sends message 165 to client-side proxy120. In some applications, message 165 is a transformation of message155. Message 165 may differ from message 155 in many ways, includingsize, encoding, framing, addressing, or other aspects. Thetransformation that produces message 165 from message 155 may beentirely different from the transformation that produced message 135from message 115. When received by client-side proxy 120, message 165 istransformed into message 175, which is identical to, or an acceptablesubstitute for, original message 155. Some improvements that suchinterceptions can provide are shown in McCanne I.

In some applications, client-side proxy 120 and server-side proxy 140form an association with the first passage of messages from client 110to server 150 via client-side proxy 120 and server-side proxy 140.Information about that association is used to arrange a similartransformation for messages sent in the reverse direction.

Asymmetrical routing occurs when an initial message and a subsequentmessage between the client 100 and the server 150 pass through one ormore different network proxies or other LAN to WAN connections. This canoccur if there are redundant links between WAN 130 and server 150 orclient 110. One or more redundant links are commonly used for loadbalancing and improved reliability. As shown in FIG. 1, server 150 isconnected with WAN 130 via server-side proxy 140 and an additionalserver-side proxy 141.

In the example shown, if conventional network routing schemes areemployed, there is no guarantee that messages from server 150 to client110 will traverse the identical link that was traversed by messages fromclient 110 to server 150, resulting in so-called asymmetric routing. Forexample, an initial communication between client 110 and server 150,using messages 115, 135, and 145, passes through server-side proxy 140to reach server 150, but the response might not.

For example, a return communication of message 156 may be intercepted bya different server-side proxy 141. Server-side proxy 141 does not knowabout client-side proxy 120 or the association between client-side proxy120 and server-side proxy 140. As a result, the server-side proxy 141treats message 156 as it would any other message that it receivedwithout additional information, e.g., passing it through unaltered asmessage 166. Message 166 then crosses the WAN 130 on its way to client110. In some arrangements, message 166 a is received directly by client110, since it is addressed to client 110; in other arrangements,client-side proxy 120 intercepts all traffic to client 110, but willpass message 166 b through unaltered to client 110 as message 176. Ineither case, the message 156 originally sent from server 150 to client110 does not benefit from the association of client-side proxy 120 andserver-side proxy 140.

Such “one-sided” or “half-way” communication means that only onedirection of traffic can benefit from the transformations performed byproxies 120, 140, and 141. In some cases, such communication patternsmay violate rules for communication between client 110 and 150, leadingto communication breakdown. A similar problem occurs when there is nosecond server-side proxy 141 or when no server-side proxy 140, 141receives message 156, so that it is simply sent unchanged from server150 to client 110.

FIG. 2 illustrates example networks having improved network traffic flowaccording to embodiments of the invention. FIG. 2A illustrates a network200 similar to network 100 described above. In an embodiment of theinvention, server-side proxies 240 and 241 of network 200 have beenconfigured as neighbors, so each can communicate with the other and/orhas some awareness of the other.

A message 215 sent by client 210 and addressed to server 250 isintercepted by client-side proxy 220. The client-side proxy 220 sendsmessage 235 to a server-side proxy 240. Message 235 may be identical tomessage 215 or a transformation of message 215 that differs in waysincluding size, encoding, framing, addressing, and/or other aspects.

When message 235 is received by server-side proxy 240, an additionalstep takes place if message 235 is the establishment of a newclient/server connection: in such a case, server-side proxy 240 providesnew-connection information 248 derived from message 235 to neighborserver-side proxy 241. Neighbor server-side proxy 241 stores thatnew-connection information 248 and associates it with owning server-sideproxy 240.

Server-side proxy 240 also transforms message 235 into message 245,which is identical to, or an acceptable substitute for, original message215. Thus, the two proxies 220 and 240 are invisible in their effect:client 210 and server 250 send and receive messages that are identicalto, or an acceptable substitute for, what would occur if message 215were simply sent directly to server 250. For example, network trafficcommunicated from server-side proxy 240 to server 250 might have thesource address of client 210.

For communications between the server 250 and the client 210, neighborserver-side proxy 241 may receive message 246 addressed to client 210from server 250. Upon receiving communications, such as message 246 fromthe server 250, neighbor server-side proxy 241 uses its storednew-connection information 248 to determine that message 246 belongs toa connection made through server-side proxy 240. Of course, server-sideproxy 240 can receive the message and handle it directly. Such messageflows are not shown in FIG. 2A, but might be expected to proceed asshown in FIG. 1.

In response to this determination, server-side proxy 241 forwardsmessage 247 to server-side proxy 240, in effect “forwarding” theconnection to its handling proxy. Server-side proxy 240 then processesmessage 247. Using information about its association with client-sideproxy 220, server-side proxy 240 transforms message 247 into message244, which is in turn sent across WAN 230. Client-side proxy 220 thentransforms message 244 into message 249, where message 249 is identicalto, or an acceptable substitute for, original message 246.

Messages can be forwarded between neighboring network proxies in anumber of different ways. In an embodiment, a forwarding server-sideproxy changes the destination address of a message to the address ofanother neighboring server-side proxy. In one implementation of thisembodiment, the forwarding proxy does not change the source address ofthe forwarded message to match its own address and instead retains thesource address of the message, for example the server 250. The proxyreceiving the forwarded message maintains a connection state internallycorresponding to a connection between itself and the original source ofthe message. Thus, to the proxy receiving the forwarded message from aneighboring proxy, the forwarded message appears to have been receivedfrom the original source of the message, rather than from theneighboring proxy.

In another embodiment, a message is forwarded from proxy 241 to aneighboring proxy by encapsulating the entire message in anothermessage, for example in a generic routing encapsulation (“GRE”) tunnelestablished between neighboring proxies. In still another embodiment, amessage is forwarded from a forwarding proxy to a neighboring proxy byextracting payload and destination information from original message andsending the payload in a suitable data structure across a TCP, SCTP, orsimilar connection between the proxies.

In general, messages can be forwarded between neighboring networkproxies at the level of detection and forwarding of one or more networkpackets comprising each message, at the higher-level of semantic requestand response messages, or at any intermediate level of processing.

FIG. 2B illustrates an example network 255 according to an embodiment ofthe invention. Network 255 is similar to network 200, except that thereare two client-side network proxies. In this example, client-sideproxies 290 and 291 of network 255 have been configured as neighbors, soeach can communicate with the other and/or has some awareness of theother.

A message 265 sent by client 260 and addressed to server 275 isintercepted by client-side proxy 290. Client-side proxy 290 sends amessage 285 to server-side proxy 270. Message 285 may be identical tomessage 265 or a transformation of message 265 that differs in waysincluding size, encoding, framing, addressing, and/or other aspects.

When message 265 is received by client-side proxy 290, an additionalstep takes place if message 265 is the establishment of a newclient/server connection. In such a case, client-side proxy 290 providesnew-connection information 268 derived from message 265 to neighboringclient-side proxy 291. Neighbor client-side proxy 291 stores thatnew-connection information 268 and associates it with owning client-sideproxy 290.

Server-side proxy 270 receives message 285 and transforms it intomessage 287, which is identical to, or an acceptable substitute fororiginal message 265. Thus the two proxies 290 and 270 are invisible intheir effect: client 260 and server 275 send and receive messages thatare identical to, or an acceptable substitute for what would occur ifmessage 265 were simply sent directly to server 275. For example,network traffic communicated from server-side proxy 270 to server 275might have the source address of client 260.

For communications between the server 275 and the client 260, theneighbor client-side proxy 291 may receive messages from the server 275.For example, server 275 can send message 277 directed to client 260 andserver-side proxy 270 can intercept message 277 and can transform itinto message 288, which can be identical to message 277 or atransformation of message 277 that differs in ways including size,encoding, framing, addressing, and/or other aspects. For example,message 288 can be a compressed version of message 277.

Due to the routing characteristics of wide area network 280, message 288might be received by either client-side proxy 290 or 291. If message 288is received by client-side proxy 290, which previously established andtherefore “owns” the connection between client 260 and server 275,client-side proxy 290 uses information about its association withserver-side proxy 270 and other previously stored information totransform message 288 into message 295, which is in turn sent to client260. Message 295 is identical to, or an acceptable substitute for,original server message 277.

Alternatively, if message 288 is received by client-side proxy 291,client-side proxy 291 uses stored new-connection information 268 todetermine that message 288 belongs to a connection made throughclient-side proxy 290. In response to this determination, client-sideproxy 291 forwards message 288 to client-side proxy 290 via message 297.Client-side proxy 290 then transforms message 297 into message 295,which is in turn sent to client 260. Message 295 is identical to, or anacceptable substitute for, original server message 277. Variousmessages, such as forwarding messages, can have a packet-to-packetcorrespondence with the messages they are transformed from, or not.

As with other embodiments, messages can be forwarded between neighboringnetwork proxies in a number of different ways. In an embodiment, aforwarding client-side proxy changes the destination address of amessage to the address of another neighboring client-side proxy. In oneimplementation of this embodiment, the forwarding proxy does not changethe source address of the forwarded message to match its own address andinstead retains the source address of the message, for example theserver 275. The proxy receiving the forwarded message maintains aconnection state internally corresponding to a connection between itselfand the original source of the message. Thus, to the proxy receiving theforwarded message from a neighboring proxy, the forwarded messageappears to have been received from the original source of the message,rather than from the neighboring proxy.

In another embodiment, a message is forwarded from proxy 291 toneighboring proxy by encapsulating the entire message in anothermessage, for example in a GRE tunnel established between neighboringproxies. In still another embodiment, a message is forwarded from aforwarding proxy to a neighboring proxy by extracting payload anddestination information from original message and sending the payload ina suitable data structure across a TCP, SCTP, or similar connectionbetween the proxies.

As discussed above, messages in general can be forwarded betweenneighboring network proxies at the level of detection and forwarding ofone or more network packets comprising each message, at the higher-levelof semantic request and response messages, or at any intermediate levelof processing.

Although FIGS. 2A-2B show the neighbor configuration, new-connectioninformation, and forwarding occurring at either the server-side proxy orclient-side proxy, similar techniques may also be applied with bothclient-side and server-side proxies. Thus it is possible for aclient-server exchange of messages to cause new-connection informationto be sent to client-side neighbor proxies, then cause new-connectioninformation to be sent to server-side neighbor proxies, then for amessage to be forwarded among server-side proxies, and then for amessage to be forwarded among client-side proxies. The number ofneighbor proxies and the details of the new-connection information maybe different on the client-side and on the server-side. In addition,these techniques can be used whether a connection is initiated at theclient or the server, as appropriate.

In additional embodiments, proxies may be nested. For example, WAN 230may actually be implemented as an actual WAN bracketed by a differentset of client-side proxies and server-side proxies. For such a nestedcollection of proxies, one pairing of client-side and server-sideproxies might have a non-zero number of neighbor proxies on zero, one,or both sides of the WAN; and separately, the other pairing ofclient-side and server-side proxies might have a non-zero number ofneighbor proxies on zero, one, or both sides of the WAN. Such nestingsof proxies may extend to arbitrary depth, not only the two levelsdescribed here.

FIG. 3 illustrates an example 300 of a data structure for conveying theinformation maintained by a neighboring network connection according toan embodiment of the invention. FIG. 3 shows a portion of the neighborinformation maintained by a proxy, based on new-connection messagesreceived. Entries 301 a and 301 b each comprise a target element 310 andan owner element 320. The meaning of each entry is that for any trafficreceived at this device addressed to the target, that traffic should beforwarded to the corresponding owner. Thus entry 301 a allows a neighborreceiving traffic destined for 10.3.1.10:1921 to instead forward it tothe owning proxy at 10.4.0.1:7810. Entry 301 b means that trafficdestined for 10.3.5.44:2044 should also be forwarded to the same owningproxy. (Examples herein use RFC 1918 private addresses to avoid anyinadvertent reference to an actual network; public addresses can, ofcourse, appear in the data structure.)

FIG. 3 is intended only to show the nature of the information stored andits relationship; the actual data structure is likely to include othermechanisms to allowing rapid search, cheap insertion/deletion,accommodating very large collections of information, and reclaiming oldor unused entries. In addition, some embodiments will use additionalinformation to distinguish entries, such as source address, source port,protocol number, DSCP code point, or other information readily availablefrom received traffic. Finally, some embodiments will use forms ofpattern-matching or partial specification to allow compactrepresentations of large classes of traffic. All such likely adaptationsare straightforward for one skilled in the arts. The “neighbor table”partially shown in FIG. 3 can be stored in local memory of a proxydevice, memory of a computer executing a software proxy, etc.

FIG. 4 illustrates a method 400 of initiating a new connection accordingto an embodiment of the invention. This method can be performed by oneor more components in a network and/or embodied in computer-readableinstructions to perform the method. In step 410, a proxy receives amessage. In step 420, the proxy determines whether this connection canbe optimized. Some connections may not be optimizable because ofconfiguration rules, or there may be no counterpart proxy available in asuitable network location for the client and server. If the connectionis not optimizable, in step 440 the proxy passes through the connectionwithout processing it. In other embodiments, method 400 includes stepsof processing the messages at the higher-level of semantic request andresponse messages, or at any intermediate level of processing, ratherthan at the level of detection and forwarding of one or more networkpackets comprising each message.

If the connection is optimizable, in step 430 the proxy determines if ithas neighbors. If so, in step 450 the proxy, referred to here as the“owner proxy,” supplies new-connection information to each of itsneighbors. In an embodiment, the new-connection information can becommunicated with neighboring proxies using unicast, multicast, orbroadcast techniques. Some proxies that would otherwise qualify asneighbors can be treated as non-neighbors, where appropriate.

Regardless of whether it has neighbors or not, in step 460 the ownerproxy begins applying optimizations or transformations to connectiontraffic, in cooperation with its counterpart proxy.

FIG. 5 illustrates a method of processing network traffic associatedwith a connection according to an embodiment of the invention thatbegins with a proxy receiving a message. In step 510, the proxy receivesthe message. In step 520, the proxy determines whether the message'sdestination matches one in its neighbor table, such as that diagrammedin FIG. 3. If the message's destination does not match any entry in theneighbor table, the process continues with step 530 wherein the proxyprocesses the message normally. This can include forwarding the messageto its destination and optionally transforming the message for purposesof caching or network acceleration or other operation.

Conversely, if in step 520 it is determined that the message does matchan entry in the neighbor table, the proxy can rewrite (step 540) andforward (step 550) the message or an equivalent thereof to theappropriate neighbor network proxy for processing. Forwarding can beaccomplished using a variety of different techniques, including theaddress swapping, tunneling, and payload extraction techniques discussedabove. As described previously, embodiments of method 500 can includeprocessing the messages comprising one or more packets at thehigher-level of semantic request and response messages, at anyintermediate level of processing, or at the level of detection andforwarding of the one or more network packets comprising each message. Amessage can be part of a packet, comprise one packet per message, orcomprise a plurality of pockets, depending on context.

In a further embodiment, network proxies can be dynamically added. Inone implementation, newly added proxies receive and process all networktraffic normally, as if their neighbor tables were empty. As a result,some types of network transactions will be disrupted due to the effectsof asymmetric routing and other network effects, such as those describedpreviously. Clients and servers will recover from the disrupted networktransactions by initiating a new network connection. The new networkconnection will be intercepted by the network proxies and result in newconnection information being forwarded to a newly added proxy, therebyupdating its neighbor table.

FIG. 6 illustrates an additional network 600 according to an embodimentof the invention. Network 600 is shown including a set of server-sideproxies 605, 610, and 615. Other network elements might exist that arenot shown. As with the other embodiments, each of the set of server-sideproxies can be associated with one or more client-side proxies, whichare omitted from FIG. 6 for clarity. The association between client-sideand server-side proxies enables transformations that improve networkperformance and perform possibly other roles. In this networkconfiguration 600, server-side proxies do not have to be in-line withthe connections with the wide-area network.

Network 600 includes a set of routers 620. Each of the set of routers620 has a connection with one or more wide-area networks. A set ofinterceptor modules 625 are connected with the set of routers 620. Asexplained in detail below, the set of interceptor modules 625 areadapted to intercept and, if necessary, redirect network traffic topreserve routing symmetry. In an embodiment, each of the set of routers620 is associated with one of the set of interceptor modules 625. Inalternate embodiments, routers and interceptor modules may be associatedin different ratios.

The set of interceptor modules are connected with each other and the setof server-side proxies 605, 610, and 615 via a local network 630 thatincludes one or more network switches and other networking devices, suchas network switches 631, 633, and 635. A set 640 of one or more servers,each labeled “S” in FIG. 6, is also connected with local network 630.The set of servers 640 provide applications, information, and servicesto one or more clients. For clarity, clients are omitted from FIG. 6,but might be coupled to routers 620.

The set of interceptor modules 625 preserve routing symmetry for networktraffic between clients and the set of servers 640. For example, aclient sends an initial message 650 to a server. Initial message 650 canbe communicated from the client, via a client-side network proxy, andthrough a wide-area network, not shown, to reach network 600. Message650 may be directed at a specific one of the set of servers 640 or ingeneral to any of the set of servers 640 or a subset thereof.

Upon receipt of initial message 650 via router 620(a) of the set ofrouters 620, message 650 is passed to associated interceptor module625(a). If routing symmetry needs to be preserved for this and possiblysubsequent communications with this client, interceptor module 625(a)selects an appropriate server-side proxy to associate with the client'sclient-side proxy. Embodiments of interceptor module 625(a) can select aserver-side proxy in any number of ways to achieve load-balancing orother goals. Example load-balancing schemes can include round-robin,load-based, sticky, mapping using hashes of an IP address or othermessage property, or any other load-balancing scheme used formanipulating network traffic that is known in the art and suitable forsuch operations.

In accordance with this selection, interceptor module 625(a) sends theinitial message 650 to the selected server-side proxy. Additionally,interceptor module 625(a) sends a new-connection information message 665to the each of other interceptor modules of set 625 and stores a copy ofthis new-connection information for itself. In an embodiment, thenew-connection information message 665 is communicated with the otherinterceptor modules using a unicast, multicast, or broadcast networkprotocol on the network 630. It should be understood that similaroperations could be done with proxy/interceptor pairs other than620(a)/625(a).

In an embodiment, the new-connection information message 665 includesone or more routing table rules for redirecting network trafficassociated with the pertinent client to the selected server-side proxy.In a further embodiment, the routing table rules include one or morerules for redirecting network traffic from the pertinent client to theselected server-side proxy. Additionally, the routing table rulesinclude one or more rules for redirecting network traffic from one ormore of the set of servers 640 and directed to that client to theselected server-side proxy.

In further embodiments, network traffic associated with a given clientis assigned to a unique port of the selected server-side proxy. In anembodiment, an autodiscovery protocol is used so that the client-sideproxy and interceptor modules learn which port to connect with on theselected server-side proxy. In another embodiment, a set of rules on theclient-side proxy and/or the interceptor modules define the appropriateport to connect with on the server proxy.

Once the other interceptor modules of set 625 have received thenew-connection information message 665, all network traffic associatedwith the client will be redirected through the selected server-sideproxy. For example, a message 670 from server 640(b) directed to theclient will travel through local network 630. Upon reaching one of theset of interceptors 625, the receiving interceptor module will matchmessage 670 with its stored new-connection information for the client.In response, that interceptor module will redirect message 670 to thepreviously selected server-side proxy. The selected server-side proxywill process and/or transform message 670 and then send the resultingmessage back through any one of the set of interceptor modules 625 andassociated one of the set of routers 620 to the client. In anotherembodiment, the new-connection information is received by the set ofrouters 620, which processes network traffic in a similar manner.

Similarly, a subsequent message 680 from the client to one of the set ofservers 640 will be received by one of the set of interceptors 625, suchas interceptor 625(c) in this example. Interceptor module 625(c) willmatch message 680 with its stored new-connection information for theclient. In response, the interceptor module 625(c) will redirect message680 to the previously selected server-side proxy. The selectedserver-side proxy will process and/or transform message 680 and thensend the resulting message back through local network 630 to one of theset of servers 640.

In an alternate embodiment, the some or all of the network proxies canbe integrated with the interceptor modules, such that each combined unitincludes a network proxy for processing and transforming associatednetwork traffic, and an interceptor module for monitoring networktraffic, creating new-connection information, and using new-connectioninformation to redirect messages as needed to other standalone networkproxies or combined interceptor module and network proxy units. In thisembodiment, standalone interceptor modules can also be employed to coveradditional connections with a wide-area network.

In a further embodiment, network proxies can be dynamically removed fromthe network. Neighbor proxies receive new-connection information andstore this information in a neighbor table. Additionally, in thisembodiment, neighbor proxies provide an acknowledgment message to theowner proxy. If the owner proxy does not receive an acknowledgment backfrom one or more of its neighbor proxies, the owner proxy assumes thenon-responsive neighbor proxies are disabled and can purge its ownneighbor table of entries associated with the non-responsive neighborproxies.

The outlined flow is for an embodiment in which each message isunambiguously handled by either the receiving proxy or a neighbor. Insome embodiments, it may be possible for a message to be handled eitherby the receiving proxy or by one of its neighbors. In such anembodiment, where such a choice should be resolved in favor of thereceiving proxy, the message processing flow will include a test afterreceiving a message and before checking for “neighbor ownership” todetermine if the message matches one that can be handled by thereceiving proxy. If the message can be handled by the receiving proxy,then processing would involve normal processing and no need for thechecking step.

Although the invention has been discussed with respect to specificembodiments thereof, these embodiments are merely illustrative, and notrestrictive, of the invention. Furthermore, the system architecturediscussed above is for the purposes of illustration. The invention canbe implemented in numerous different forms including as a stand-aloneapplication or as a module integrated with other applications. Thus, thescope of the invention is to be determined solely by the claims.

1. A system, comprising: a first initiation-side proxy and a secondinitiation-side proxy; the first initiation-side proxy comprising: a)one or more processors; b) a first network interface, for receivinginformation at the first initiation-side proxy; c) logic configured toreceive, directly or indirectly via the first network interface, firstconnection setup information for a first connection being set up betweena client and a server; and d) logic configured to send, to the secondinitiation-side proxy, second connection setup information, wherein thesecond connection setup information comprises at least a portion of thefirst connection setup information; and the second initiation-side proxycomprising: a) one or more processors; b) a second network interface,for receiving information at the second initiation-side proxy; c) logicconfigured to store the second connection setup information; and d)logic configured to receive, directly or indirectly via the secondnetwork interface: (1) connection setup response information, and (2)response-side proxy-identifying information that indicates the presenceof a response-side proxy; and e) logic configured to forward, based atleast in part on the stored second connection setup information, boththe connection setup response information and the response-sideproxy-identifying information from the second initiation-side proxy tothe first initiation-side proxy; wherein the first initiation-side proxyfurther comprises logic configured to establish a second connectionbetween the first initiation-side proxy and the response-side proxybased at least in part on the response-side proxy-identifyinginformation and in response to receiving the connection setup responseinformation.
 2. The system of claim 1, wherein the first initiation-sideproxy further comprises logic configured to proxy the one or moremessages over the second connection in response to receiving one or moremessages from the client to the server at the first initiation-sideproxy, wherein proxying the one or more messages comprises sendingrepresentations of the one or messages over the second connection to theresponse-side proxy.
 3. The system of claim 1, wherein the forwardedconnection setup response information comprises at least one of: 1) atleast a portion of a message received by the second initiation-sideproxy encapsulated using a tunneling protocol; 2) a message having amodified destination address relative to an initial destination addressas received by the second initiation-side proxy; and 3) a payloadextracted from a message received by the second initiation-side proxy.4. The system of claim 1, further comprising: logic, of the secondinitiation-side proxy, configured to receive third connection setupinformation for a third connection being set up between a second clientand a second server; logic, of the second initiation-side proxy,configured to send, to the first initiation-side proxy, fourthconnection setup information, wherein the fourth connection setupinformation comprises at least a portion of the third connection setupinformation; logic, of the first initiation-side proxy, configured tostore the fourth connection setup information; logic, of the firstinitiation-side proxy, configured to receive: (1) second connectionsetup response information, and (2) second response-sideproxy-identifying information that indicates the presence of a secondresponse-side proxy; logic, of the first initiation-side proxy,configured to forward both the second connection setup responseinformation and the second response-side proxy-identifying informationfrom the first initiation-side proxy to the second initiation-side proxybased at least in part on the stored fourth connection setupinformation; and logic, of the second initiation-side proxy, configuredto establish a fourth connection between the second initiation-sideproxy and the second response-side proxy based at least in part on thesecond response-side proxy-identifying information and in response toreceiving the second connection setup response information.
 5. Thesystem of claim 1, wherein the first response-side proxy is a differentresponse-side proxy than the second response-side proxy.
 6. The systemof claim 1, wherein the first initiation-side proxy includes logicconfigured to maintain a connection state internally based on theconnection setup response information, the connection statecorresponding to a connection between the first initiation-side proxyand the first response-side proxy as if the connection setup responseinformation sent from the second initiation-side proxy to the firstinitiation-side proxy had been received at the first initiation-sideproxy from the first response-side proxy.
 7. A method, comprising:receiving, directly or indirectly via a first network interface, at afirst initiation-side proxy comprising one or more processors, firstconnection setup information for a first connection being set up betweena client and a server; and sending, to a second initiation-side proxycomprising one or more processors, second connection setup information,wherein the second connection setup information comprises at least aportion of the first connection setup information; storing, at thesecond initiation-side proxy, the second connection setup information;receiving, directly or indirectly via a second network interface, at thesecond initiation-side proxy: (1) connection setup response information,and (2) response-side proxy-identifying information that indicates thepresence of a response-side proxy; forwarding, based at least in part onthe stored second connection setup information, both the connectionsetup response information and the response-side proxy-identifyinginformation from the second initiation-side proxy to the firstinitiation-side proxy; and establishing a second connection between thefirst initiation-side proxy and the response-side proxy based at leastin part on the response-side proxy-identifying information and inresponse to receiving the connection setup response information.
 8. Themethod of claim 7, further comprising: proxying the one or more messagesover the second connection in response to receiving one or more messagesfrom the client to the server at the first initiation-side proxy,wherein proxying the one or more messages comprises sendingrepresentations of the one or messages over the second connection to theresponse-side proxy.
 9. The method of claim 7, wherein forwarding theconnection setup response information to the first initiation-side proxycomprises at least one of: 1) encapsulating at least a portion of amessage received by the second initiation-side proxy using a tunnelingprotocol; 2) modifying a destination address of a message received bythe second initiation-side proxy; and 3) extracting the payload from amessage received by the second initiation-side proxy and sending thepayload to the first initiation-side proxy.
 10. The method of claim 7,further comprising: receiving, at the second initiation-side proxy,third connection setup information for a third connection being set upbetween a second client and a second server; sending, from the secondinitiation-side proxy to the first initiation-side proxy, fourthconnection setup information, wherein the fourth connection setupinformation comprises at least a portion of the third connection setupinformation; storing, at the first initiation-side proxy, the fourthconnection setup information; receiving, at the first initiation-sideproxy: (1) second connection setup response information, and (2) secondresponse-side proxy-identifying information that indicates the presenceof a second response-side proxy; forwarding both the second connectionsetup response information and the second response-sideproxy-identifying information from the first initiation-side proxy tothe second initiation-side proxy based at least in part on the storedfourth connection setup information; and establishing a fourthconnection between the second initiation-side proxy and the secondresponse-side proxy based at least in part on the second response-sideproxy-identifying information and in response to receiving the secondconnection setup response information.
 11. The method of claim 7,wherein the first response-side proxy is a different response-side proxythan the second response-side proxy.
 12. The method of claim 7, furthercomprising: maintaining, at the first initiation-side proxy, aconnection state internally based on the connection setup responseinformation, the connection state corresponding to a connection betweenthe first initiation-side proxy and the first response-side proxy as ifthe connection setup response information sent from the secondinitiation-side proxy to the first initiation-side proxy had beenreceived at the first initiation-side proxy from the first response-sideproxy.
 13. A system, comprising: a first device and a second device, thefirst device comprising: a) one or more processors; b) a first networkinterface, for receiving information at the first device; c) logicconfigured to receive, directly or indirectly via the first networkinterface, first connection setup information for a first connectionbeing set up between a first host and a second host; and d) logicconfigured to send, to the second device, second connection setupinformation, wherein the second connection setup information comprisesat least a portion of the first connection setup information; and thesecond device, comprising: a) one or more processors; b) a secondnetwork interface, for receiving information at the second device; c)logic configured to store, in a memory, the second connection setupinformation; d) logic configured to receive, directly or indirectly viathe second network interface, connection setup response information; e)logic configured to forward the connection setup response information tothe first device based at least in part on the stored second connectionsetup information; f) logic configured to receive, directly orindirectly via the second network interface or another networkinterface, device identifying information that indicates the presence ofa third device; and g) logic configured to forward the deviceidentifying information from the second device to the first device basedat least in part on the stored second connection setup information. 14.The system of claim 13, wherein the first device further comprises: e)logic configured to establish a second connection between the firstdevice and the third device based at least in part on the deviceidentifying information and in response to receiving the connectionsetup response information.
 15. The system of claim 13, wherein thefirst host is a client that issues requests and the second host is aserver that responds to client requests.
 16. The system of claim 13,wherein the second host is a client that issues requests and the firsthost is a server that responds to client requests.
 17. The system ofclaim 13, wherein the first device and the second device are proxies.18. The system of claim 13, wherein the first device and the seconddevice are routers.
 19. The system of claim 13, wherein the first deviceand the second device are interceptors.
 20. The system of claim 13,wherein the first host is an initiator of a transaction and the secondhost is a responder to the transaction.
 21. The system of claim 13,wherein forwarding the connection setup response information isperformed in response to a match between a connection identifierobtained at the first device as part of setup of the first connectionand a connection identifier obtained at the second device as part of theconnection setup response information.
 22. A method, performed by one ormore computing devices having network connectivity, comprising:receiving, directly or indirectly via a first network interface, at afirst device, first connection setup information for a first connectionbeing set up between a first host and a second host; sending, from thefirst device to the second device, second connection setup information,wherein the second connection setup information comprises at least aportion of the first connection setup information; storing, at thesecond device, the second connection setup information; receiving,directly or indirectly via a second network interface, at the seconddevice, connection setup response information; based at least in part onthe stored second connection setup information, forwarding, from thesecond device to the first device, the connection setup responseinformation; receiving, directly or indirectly via the second networkinterface or another network interface, at the second device, deviceidentifying information that indicates the presence of a third device;and based at least in part on the stored second connection setupinformation, forwarding the device identifying information from thesecond device to the first device.
 23. The method of claim 22, themethod further comprising: in response to receiving the connection setupresponse information and the device identifying information at the firstdevice, establishing a second connection between the first device andthe third device based at least in part on the device identifyinginformation.
 24. The method of claim 22, wherein the first host is aclient that issues requests and the second host is a server thatresponds to client requests.
 25. The method of claim 22, wherein thesecond host is a client that issues requests and the first host is aserver that responds to client requests.
 26. The method of claim 22,wherein the first device and the second device are proxies.
 27. Themethod of claim 22, wherein the first device and the second device arerouters.
 28. The method of claim 22, wherein the first device and thesecond device are interceptors.
 29. The method of claim 22, wherein thefirst host is an initiator of a transaction and the second host is aresponder to the transaction.
 30. The method of claim 22, whereinforwarding the connection setup response information is performed inresponse to a match between a connection identifier obtained at thefirst device as part of setup of the first connection and a connectionidentifier obtained at the second device as part of the connection setupresponse information.